tests: implement FUZ-01..05 property & uniformity tests

[adamkrellenstein]

Summary

Replaces the five #[ignore]-d fuzzing stubs in tests/fuzzing_targets.rs with real, deterministic property and statistical tests over the stable PoR core primitives:

• FUZ-01 merkle — build_tree → get_padded_proof_for_leaf → verify roundtrip for every padded leaf, plus the only-if direction (a proof must not verify against an unrelated root). Mirrors production usage by zero-padding the leaf count to a power of two (as validate_and_encode does).
• FUZ-02 prepare_file — coherent metadata (power-of-two padding, depth == log2(padded_len), validate() passes) and determinism of file_id/object_id/root; object_id is content-only (nonce-independent).
• FUZ-03 prove/verify — bounded random Nova roundtrip over depths 0..=3 and 1..=3 challenges.
• FUZ-04 domain-tag separation — the seven protocol domain tags yield pairwise-distinct tagged Poseidon hashes for random (x, y).
• FUZ-05 challenge-index uniformity — seeded chi-squared over 2⁸ buckets, failing only on extreme non-uniformity.

Notes

• Uses seeded StdRng (already a dev-dependency) rather than introducing proptest, so the suite stays dependency-free; each case prints reproducible seed/index context on failure. The byte-oriented cargo-fuzz harnesses under fuzz/ remain the complementary deserialization-robustness layer.
• Scope is deliberately the stable primitives (merkle, prepare, poseidon tags, challenge derivation) + a bounded prove/verify — not circuit internals or proof wire-format, which the dedicated circuit/e2e suites already cover and which the constant-size-proof work is actively changing.
• FUZ-01 surfaced (and now documents) that build_tree does not itself pad the leaf layer — padding is an upstream prepare_file responsibility.

All five pass locally; cargo clippy --all-targets --all-features -- -D warnings and the full nextest suite are green (pre-push hook passed).

---

Note

Low Risk
Test-only change to kontor-crypto; no production logic or APIs are altered.

Overview
Replaces the five ignored fuzz stubs in fuzzing_targets.rs with runnable tests in property_tests.rs, covering the same FUZ-01..FUZ-05 intent without adding proptest (seeded StdRng loops instead).

FUZ-01 exercises Merkle build → padded proof → in-place verify over many random power-of-two leaf layouts, including rejection on foreign roots and tampered siblings. FUZ-02 checks prepare_file metadata coherence, ID/root determinism, and nonce-independent object_id. FUZ-03 runs a small bounded Nova prove/verify roundtrip via existing test fixtures. FUZ-04 asserts pairwise separation of all seven Poseidon domain tags. FUZ-05 applies a fixed-seed chi-squared test on derive_index_from_bits at depth 8.

Byte-oriented cargo-fuzz harnesses under fuzz/ are unchanged as the deserialization layer; production crypto code is not modified.

^{Reviewed by Cursor Bugbot for commit 8a7e0c3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 13 untouched benchmarks
⏩ 13 skipped benchmarks¹

---

_{Comparing adam/crypto-proofs-fuzzing (8a7e0c3) with main (a4ccddd)}

Footnotes

1. 13 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩